CVE-2026-85097

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10

Description An unauthenticated arbitrary file upload issue exists due to insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An attacker can obtain a valid nonce via the bricksforge regenerate nonce AJAX endpoint and upload a GIF/PHP polyglot file (a file that is valid as both a GIF image and a PHP script) to the temporary upload directory. By submitting a form where the server-side file path points to the validated GIF but the URL field ends with a .php extension, an unauthenticated attacker can upload and execute arbitrary PHP code on the server.

Recommendations Update the plugin to a version newer than 3.1.8.9.